AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
The Nigeria Data Protection Act 2023 applies to a UK employer that processes personal data of people in Nigeria, even if the employer has no Nigerian office. HR data needs a lawful basis (usually the employment contract or a legal obligation such as PAYE and pension), staff must be told what is collected and why, breaches likely to put staff at risk must be reported to the Nigeria Data Protection Commission within 72 hours, and moving staff files to the UK needs one of the transfer grounds in sections 41 to 43 of the Act.
A UK company that hires in Lagos collects a lot about its staff: identity documents, NIN and BVN details for payroll, bank accounts, pension PINs, addresses, next of kin, sick notes, performance reviews. Most of it ends up in UK-hosted HR and payroll software. Nigerian law has something to say about each step.
Does the NDPA apply to a UK employer?
Yes, in most cases. Section 2(2) of the Act covers a controller or processor that is domiciled, resident or operating in Nigeria, processing that takes place in Nigeria, and a controller or processor outside Nigeria that processes personal data of a data subject in Nigeria. A UK employer of Lagos staff falls within the last limb even if it has no Nigerian entity. If the data also sits in the UK, UK GDPR applies alongside it; see Nigerian staff accessing UK data for the reverse direction.
Lawful basis for HR data
Section 25(1) lists the lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. For staff data, match each purpose to a basis:
| Purpose | Likely basis |
|---|---|
| Paying salary, bank details, job records | Performance of the employment contract |
| PAYE, pension, statutory returns | Legal obligation |
| Security logs, device management, fraud checks | Legitimate interests, with a written balancing test |
| Staff photos on the website, optional surveys | Consent, which can be withdrawn at any time |
Relying on consent for core HR is risky: an employee may not feel free to refuse, and consent can be withdrawn. Section 26 also puts the burden of proving consent on the controller and says silence is not consent.
What to tell staff
Section 27(1) requires that at collection you tell people your identity and contact details, the lawful basis and purposes, who receives the data, their rights, how long you keep it, their right to complain to the Commission and any automated decision-making. A staff privacy notice in the onboarding pack covers this. Staff rights under section 34 include access, correction, erasure and restriction, so build a way to answer requests.
Security and breaches
Section 39 requires appropriate security measures. Section 40(2) requires the controller to notify the NDPC within 72 hours of becoming aware of a breach likely to risk people's rights and freedoms, and where the risk is high, the staff affected must be told without delay. A lost laptop with an unencrypted payroll export is the typical case.
Vendors
Your HR platform, payroll bureau and employer of record are processors. Section 29 requires a written agreement setting out their duties, including security and helping you answer staff requests.
Sending staff files to the UK
Section 41(1) says personal data may not be transferred out of Nigeria unless the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification giving adequate protection. Section 43 gives fallbacks, including consent after being told the risks and transfers necessary for a contract with the person. Section 41(2) requires you to record the basis you rely on. In practice most UK employers rely on contractual clauses with the UK entity and their software vendors, and keep a short transfer record.
How long to keep staff data
Section 24(1) sets the principles: processing must be fair, lawful and transparent, limited to its purpose, minimised, kept no longer than necessary and secure. For HR that means a retention schedule rather than keeping everything forever. A workable pattern:
- Payroll and tax records: keep for as long as tax authorities can look back at them, and note the period you chose and why.
- Recruitment files for unsuccessful candidates: delete after a short, stated period unless the candidate agrees to stay on file.
- Identity document copies: keep only what payroll and pension registration need; restrict who can open them.
- Sick notes and medical letters: store separately from the general personnel file, with access limited to the people who must see them.
Worked example: a lost laptop
Example only. A UK manager's laptop holding an unencrypted export of Lagos payslips is stolen at 18:00 on a Monday, and the company learns of it at 09:00 on Tuesday. The 72-hour clock in section 40(2) runs from becoming aware, so the NDPC notification is due by 09:00 on Friday. Section 40(2) allows information to be given in phases, so file what you know by then and update later. Because payslips show pay, bank and identity details, the risk to staff is likely high, and they should be told without delay what happened and what to watch for.
Registration and penalties
Data controllers and processors "of major importance" must register with the NDPC. A Templars note (January 2026) says the 2025 implementation directive puts organisations processing data of more than 1,000 people in six months into the higher tiers, with annual compliance audit returns due by 31 March. A small team alone will rarely reach that, but your customer data may. The NDPC's FAQ says remedial fees can reach the greater of ₦2,000,000 and 2% of annual gross revenue, or for those of major importance the greater of ₦10,000,000 and 2%. More detail: do you need to register as a controller of major importance?
Steps
- Map the staff data you hold and where it is stored.
- Assign a lawful basis to each purpose.
- Issue a staff privacy notice.
- Sign processor agreements with HR and payroll vendors.
- Record your transfer basis for data leaving Nigeria.
- Write a breach plan with the 72-hour clock in it.
Where Pryme fits
If you pay Lagos staff through Pryme, payroll data stays in one place rather than in spreadsheets emailed between offices (payroll). Pryme's security uses an authenticator app rather than SMS codes and a transaction PIN (security). See also the NDPA for UK businesses.
Questions people ask
Does the Nigeria Data Protection Act apply to a UK company with Nigerian staff?
Yes. Section 2(2) covers controllers outside Nigeria that process personal data of people in Nigeria.
Can I rely on staff consent for HR data?
It is risky for core HR because consent can be withdrawn and must be freely given. Contract and legal obligation usually fit payroll and statutory returns better.
How fast must I report a staff data breach in Nigeria?
Within 72 hours of becoming aware, to the NDPC, where the breach is likely to risk people's rights; high-risk breaches must also be told to staff without delay.
Can I store Nigerian staff files in the UK?
Yes, if you rely on one of the transfer grounds in sections 41 to 43, such as contractual clauses, and record the basis.
Sources
- Nigeria Data Protection Act 2023 (KPMG copy) · accessed Oct 2026
- NDPC: Frequently asked questions · accessed Oct 2026
- Mondaq (Templars): Data protection compliance in Nigeria, audit return obligations for 2026 (28 Jan 2026) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.